Sincedb Creation with %{type} syntaxe

Elastic Stack Logstash
1

Hi,

I would like to be able to create different sincedb for each logstash conf file as below by inserting %{mytype} in the sincedb_path string.

input {
   file {
        type => "appname"
        path => "/path/to/catalina.out"
        sincedb_path => "/usr/share/logstash/sincedb/input.sincedb.%{type}"
        codec =>
           multiline {
               pattern => "^%{YEAR}-%{MONTHNUM}-%{MONTHDAY}\s*%{HOUR}:?%{MINUTE}(?::?%{SECOND})"
               negate => true
               what => "previous"
               charset => "ASCII"
          }
   }
}

But the filename isn't created as I want expected

-rw-r--r-- 1 logstash logstash 24 mars 12 10:53 input.sincedb.%{type}

I would like the filename look like

-rw-r--r-- 1 logstash logstash 24 mars 12 10:53 input.sincedb.appname

Any help would be appreciated.
Thanks

2

You can't make %{fieldname} references inside the input section.

3

Does sincedb act intelligently and recognize each conf file ?

4

What do you mean?

5

I have several conf in which input file read different file.
Does sincedb could differentiate the last position of each file where logstash has read ?
Regards

6

If you don't specify sincedb_path at all Logstash will, as documented, pick a sincedb path based on the filename pattern. That should be fine in your case. If you want to set the sincedb path yourself that's fine too but then it's up to you to make sure the sincedb path for each file input is unique.

7

Hi Magnus,

As part of my logs file are from Tomcat, they have the same name like catalina.out.
Could it be confusing for Logstash ?
Regards

8

No, of course not.